CVE-2026-45762High· 7.5▾ TwilightSuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracke…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AF_PACKET, enabling AF_PACKET's defrag option may prevent Suricata from seeing such fragmented packets.
suricata >= 8.0.0, < 8.0.5suricata < 7.0.16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45764Critical· 9.1Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine
CVE-2026-94083Critical· 9.4Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade)
CVE-2026-46352High· 7.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine
CVE-2026-46387High· 7.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine
CVE-2026-45763Medium· 5.9Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine
CVE-2026-45768High· 7.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine